braces EUVD-2026-82983

Requires an application that passes attacker-controlled strings into braces' expansion/compilation (the braces(), expand(), or compile() paths whose recursive AST walkers lack depth guards). The malicious input is a brace pattern with deep nesting kept under braces' internal character limit, so length-based input validation does not block it. Exploitation is limited to environments where such untrusted brace/glob input is reachable (e.g. via a web parameter or filename processed through micromatch/chokidar-style globbing); braces itself is a library with no network listener, and impact is confined to crashing the Node.js process (availability only). No authentication or user interaction is required on the vulnerable code path per the CVSS vector.

The vendor CVSS 4.0 score of 8.7 is driven entirely by VA:H (availability) with VC:N/VI:N - this is a pure denial-of-service, not a confidentiality or code-execution issue, so the headline 'High/Critical' number overstates real-world impact for most deployments. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) claims unauthenticated remote reachability, but that only holds when an application actually forwards attacker-controlled strings into braces' expand/compile path; braces is a library, not a listening service, so exploitability is entirely conditional on how the consuming application wires untrusted input. There is no EPSS score, no CISA KEV listing, and no explicit proof-of-concept exploit provided - only a GitHub issue (#70) and a VulnCheck advisory - so this is 'no public exploit identified at time of analysis' despite the high CVSS. My independent 3.1 assessment is ~7.5 (A:H only). Net: a real but bounded availability risk whose priority hinges on whether a given service exposes brace-pattern parsing to untrusted input, not a widespread active-exploitation emergency. The 'Buffer Overflow' tag is misleading - this is recursive stack exhaustion (CWE-674), not a memory-corruption buffer overflow.

An attacker sends a deeply nested brace pattern (e.g. many stacked '{...}' levels) kept under braces' character limit to an application that expands user-supplied glob/brace strings. The recursive AST walkers in parse/compile/expand exceed the JavaScript call-stack depth, throwing an uncaught RangeError that terminates the Node.js process. No public PoC is provided beyond the referenced GitHub issue, and no authentication or user interaction is required where the input path is reachable.